Video – Hacking OS X FileVault2 over Thunderbolt with Inception

I’ve created a short video showing how to attack OS X Lion with FileVault2 enabled using my tool, Inception.

In the video, I attack a fully patched Mac OS X Lion machine with full-disk encryption enabled (FileVault2), while the machine is powered on and a user is logged in. Using Inception, I am able to dump the memory of the target, and use strings and grep to find the FileVault2 password.